3
l�_�6 � @ s� d dl mZmZmZ d dlZd dlmZmZ d dlm Z d dl
m Z m Z m
Z
mZmZmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZm Z d d
� Z d d � Z d
d� Z dd� Z dd� Z!ej"e�G dd� de#��Z$ej"e�G dd� de#��Z%dS )� )�absolute_import�division�print_functionN)�utils�x509)�UnsupportedAlgorithm)� _CRL_ENTRY_REASON_CODE_TO_ENUM�_asn1_integer_to_int�_asn1_string_to_bytes�_decode_x509_name�_obj2txt� _parse_asn1_generalized_time)� _Certificate)�
serialization)�OCSPCertStatus� OCSPRequest� OCSPResponse�OCSPResponseStatus�_CERT_STATUS_TO_ENUM�
_OIDS_TO_HASH�_RESPONSE_STATUS_TO_ENUMc s t j� �� fdd��}|S )Nc s( | j tjkrtd��n� | f|�� S d S )NzCOCSP response status is not successful so the property has no value)�response_statusr �
SUCCESSFUL�
ValueError)�self�args)�func� � /usr/lib64/python3.6/ocsp.py�wrapper! s z._requires_successful_response..wrapper)� functools�wraps)r r r )r r � _requires_successful_response s
r" c C s^ | j jd�}| jj| j j| j j|| j j|�}| j|dk� | j|d | j jk� t| |d �S )NzASN1_OCTET_STRING **� r )�_ffi�new�_lib�OCSP_id_get0_info�NULL�openssl_assertr
)�backend�cert_idZkey_hash�resr r r �_issuer_key_hash. s r- c C s^ | j jd�}| jj|| j j| j j| j j|�}| j|dk� | j|d | j jk� t| |d �S )NzASN1_OCTET_STRING **r# r )r$ r% r& r' r( r) r
)r* r+ Z name_hashr, r r r �_issuer_name_hash< s r. c C s^ | j jd�}| jj| j j| j j| j j||�}| j|dk� | j|d | j jk� t| |d �S )NzASN1_INTEGER **r# r )r$ r% r& r' r( r) r )r* r+ �numr, r r r �_serial_numberJ s r0 c C s� | j jd�}| jj| j j|| j j| j j|�}| j|dk� | j|d | j jk� t| |d �}yt| S tk
r� t dj
|���Y nX d S )NzASN1_OBJECT **r# r z*Signature algorithm OID: {} not recognized) r$ r% r& r' r( r) r r �KeyErrorr �format)r* r+ Zasn1objr, �oidr r r �_hash_algorithmT s r4 c @ sb e Zd Zdd� Zejd�Zeedd� ��Z eedd� ��Z
eedd � ��Z eed
d � ��Z eed d
� ��Z
eedd� ��Zeedd� ��Zdd� Zeedd� ��Zeedd� ��Zeedd� ��Zeedd� ��Zeed d � ��Zeed d � ��Zeed d!� ��Zeed"d#� ��Zeed$d%� ��Zeed&d'� ��Zejed(d)� ��Z ejed*d+� ��Z d,d-� Z d.S )/�
_OCSPResponsec C s || _ || _| j jj| j�}| j j|tk� t| | _| jtjkr�| j jj | j�}| j j|| j j
j k� | j j
j || j jj
�| _| j jj| j�}|dkr�tdj|���| j jj| jd�| _| j j| j| j j
j k� | j jj| j�| _| j j| j| j j
j k� d S )Nr# zhOCSP response contains more than one SINGLERESP structure, which this library does not support. {} foundr )�_backend�_ocsp_responser& ZOCSP_response_statusr) r �_statusr r ZOCSP_response_get1_basicr$ r( �gcZOCSP_BASICRESP_free�_basicZOCSP_resp_countr r2 ZOCSP_resp_get0�_singleZOCSP_SINGLERESP_get0_id�_cert_id)r r* Z
ocsp_response�statusZbasicZnum_respr r r �__init__j s.
z_OCSPResponse.__init__r8 c C s> | j jj| j�}| j j|| j jjk� t| j |j�}t j
|�S )N) r6 r& ZOCSP_resp_get0_tbs_sigalgr: r) r$ r( r � algorithmr ZObjectIdentifier)r Zalgr3 r r r �signature_algorithm_oid� s z%_OCSPResponse.signature_algorithm_oidc C s8 | j }y
tj| S tk
r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)r@ r Z_SIG_OIDS_TO_HASHr1 r r2 )r r3 r r r �signature_hash_algorithm� s
z&_OCSPResponse.signature_hash_algorithmc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r6 r& ZOCSP_resp_get0_signaturer: r) r$ r( r
)r Zsigr r r � signature� s z_OCSPResponse.signaturec s� � j jj� j�}� j j|� j jjk� � j jjd�}� j jj||�}� j j|d � j jjk� � j jj |� fdd��}� j j|dk� � j jj
|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r6 r& Z OPENSSL_free)Zpointer)r r r �� s z2_OCSPResponse.tbs_response_bytes..) r6 r& ZOCSP_resp_get0_respdatar: r) r$ r( r% Zi2d_OCSP_RESPDATAr9 �buffer)r ZrespdataZppr, r )r r �tbs_response_bytes� s z _OCSPResponse.tbs_response_bytesc C sz | j jj| j�}| j jj|�}g }xRt|�D ]F}| j jj||�}| j j|| j jj k� t
| j |�}| |_ |j |� q,W |S )N)
r6 r& ZOCSP_resp_get0_certsr: Z sk_X509_num�rangeZ
sk_X509_valuer) r$ r( r Z
_ocsp_resp�append)r Zsk_x509r/ Zcerts�ir Zcertr r r � certificates� s z_OCSPResponse.certificatesc C s. | j � \}}|| jjjkr d S t| j|�S d S )N)�_responder_key_namer6 r$ r( r
)r �_� asn1_stringr r r �responder_key_hash� s z _OCSPResponse.responder_key_hashc C s. | j � \}}|| jjjkr d S t| j|�S d S )N)rJ r6 r$ r( r )r � x509_namerK r r r �responder_name� s z _OCSPResponse.responder_namec C sP | j jjd�}| j jjd�}| j jj| j||�}| j j|dk� |d |d fS )NzASN1_OCTET_STRING **z X509_NAME **r# r )r6 r$ r% r& ZOCSP_resp_get0_idr: r) )r rL rN r, r r r rJ � s z!_OCSPResponse._responder_key_namec C s | j jj| j�}t| j |�S )N)r6 r& ZOCSP_resp_get0_produced_atr: r
)r � produced_atr r r rP � s z_OCSPResponse.produced_atc C sH | j jj| j| j jj| j jj| j jj| j jj�}| j j|tk� t| S )N)r6 r& �OCSP_single_get0_statusr; r$ r( r) r )r r= r r r �certificate_status� s z _OCSPResponse.certificate_statusc C sr | j tjk rd S | jjjd�}| jjj| j| jjj || jjj | jjj � | jj
|d | jjj k� t | j|d �S )NzASN1_GENERALIZEDTIME **r ) rR r �REVOKEDr6 r$ r% r& rQ r; r( r) r
)r � asn1_timer r r �revocation_time� s z _OCSPResponse.revocation_timec C s| | j tjk rd S | jjjd�}| jjj| j|| jjj | jjj | jjj � |d dkrXd S | jj
|d t k� t |d S d S )Nzint *r r# �����) rR r rS r6 r$ r% r& rQ r; r( r) r )r Z
reason_ptrr r r �revocation_reason s z _OCSPResponse.revocation_reasonc C sb | j jjd�}| j jj| j| j jj| j jj|| j jj� | j j|d | j jjk� t| j |d �S )NzASN1_GENERALIZEDTIME **r ) r6 r$ r% r& rQ r; r( r) r
)r rT r r r � this_update s z_OCSPResponse.this_updatec C sb | j jjd�}| j jj| j| j jj| j jj| j jj|� |d | j jjkrZt| j |d �S d S d S )NzASN1_GENERALIZEDTIME **r )r6 r$ r% r& rQ r; r( r
)r rT r r r � next_update, s z_OCSPResponse.next_updatec C s t | j| j�S )N)r- r6 r< )r r r r �issuer_key_hash< s z _OCSPResponse.issuer_key_hashc C s t | j| j�S )N)r. r6 r< )r r r r �issuer_name_hashA s z _OCSPResponse.issuer_name_hashc C s t | j| j�S )N)r4 r6 r< )r r r r �hash_algorithmF s z _OCSPResponse.hash_algorithmc C s t | j| j�S )N)r0 r6 r< )r r r r �
serial_numberK s z_OCSPResponse.serial_numberc C s | j jj| j�S )N)r6 Z_ocsp_basicresp_ext_parser�parser: )r r r r �
extensionsP s z_OCSPResponse.extensionsc C s | j jj| j�S )N)r6 Z_ocsp_singleresp_ext_parserr^ r; )r r r r �single_extensionsU s z _OCSPResponse.single_extensionsc C sL |t jjk rtd��| jj� }| jjj|| j�}| jj |dk� | jj
|�S )Nz/The only allowed encoding value is Encoding.DERr ) r �Encoding�DERr r6 �_create_mem_bio_gcr& Zi2d_OCSP_RESPONSE_bior7 r) �
_read_mem_bio)r �encoding�bior, r r r � public_bytesZ s
z_OCSPResponse.public_bytesN) �__name__�
__module__� __qualname__r> r Zread_only_propertyr �propertyr" r@ rA rB rE rI rM rO rJ rP rR rU rW rX rY rZ r[ r\ r] �cached_propertyr_ r` rg r r r r r5 h sT
r5 c @ sZ e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d
� �Ze j
d d � �Z d
d� Z dS )� _OCSPRequestc C s~ |j j|�dkrtd��|| _|| _| jj j| jd�| _| jj| j| jjj k� | jj j
| j�| _ | jj| j | jjj k� d S )Nr# z+OCSP request contains more than one requestr ) r& ZOCSP_request_onereq_count�NotImplementedErrorr6 �
_ocsp_requestZOCSP_request_onereq_get0Z_requestr) r$ r( ZOCSP_onereq_get0_idr< )r r* Z ocsp_requestr r r r> h s z_OCSPRequest.__init__c C s t | j| j�S )N)r- r6 r< )r r r r rZ v s z _OCSPRequest.issuer_key_hashc C s t | j| j�S )N)r. r6 r< )r r r r r[ z s z _OCSPRequest.issuer_name_hashc C s t | j| j�S )N)r0 r6 r< )r r r r r] ~ s z_OCSPRequest.serial_numberc C s t | j| j�S )N)r4 r6 r< )r r r r r\ � s z_OCSPRequest.hash_algorithmc C s | j jj| j�S )N)r6 Z_ocsp_req_ext_parserr^ ro )r r r r r_ � s z_OCSPRequest.extensionsc C sL |t jjk rtd��| jj� }| jjj|| j�}| jj |dk� | jj
|�S )Nz/The only allowed encoding value is Encoding.DERr ) r ra rb r r6 rc r& Zi2d_OCSP_REQUEST_bioro r) rd )r re rf r, r r r rg � s
z_OCSPRequest.public_bytesN)
rh ri rj r> rk rZ r[ r] r\ r rl r_ rg r r r r rm f s rm )&Z
__future__r r r r Z cryptographyr r Zcryptography.exceptionsr Z0cryptography.hazmat.backends.openssl.decode_asn1r r r
r r r
Z)cryptography.hazmat.backends.openssl.x509r Z cryptography.hazmat.primitivesr Zcryptography.x509.ocspr r r r r r r r" r- r. r0 r4 Zregister_interface�objectr5 rm r r r r � s" $
~